ipsec vpn

[r0verken]

Hi

When using pptp my external ip changes, but when using cisco ipsec vpn it stays the same however I can still connect to machines on the vpn. If i were to traceroute neowin, the traceroute wouldnt change from what i would normally see.

Does it only foward traffic through the vpn server for some hostnames? pptp seems to foward everything.

Thanks

[+BudMan MVC]

Depends on if your vpn connection is setup to be the default gateway or not. Sounds like your cisco connection is allowing for split tunnel - which normally is a no no and companies do not allow for that

On your pptp/vpn connection you can check

I would post a picture for the cisco client, but don't feel like firing up my laptop, etc.

[r0verken]

I am using a mac, when connecting to the vpn and visiting whatismyip.com it reports the same IP as when im not on the vpn. I have not changed any settings on the mac, however am definitely on the vpn as I can ping internal mail servers etc.

The exact same thing happens with the cisco client on windows but I cant find anything on either pc about split tunnel.. does cisco ipsec work out which hosts are on the vpn and only redirect their traffic?

Thanks

[+BudMan MVC]

Does not matter what OS your on -- the settings for a vpn are the same, either use the remote gateway or not, and just route traffic to the connection. Only thing that would change is the where in some gui you would make the change, or maybe terms slightly different

The cisco client would be setup by the vpn admin on the other end if you can split tunnel or not.

On the cisco client it would be call allow local access or something like that - would have to fire up client.. And then again it might have changed terms a bit.. Which cisco client are you using? 5 I would guess.. Cisco is going to end support for the ipsec clients -- need to move to the anyclient which is all SSL based.

Just take a look at your route table when you connect to your vpn and you will see what will happen. A VPN can either route all traffic through the vpn connection, or it can just add a route to the other network(s) on the other end of the vpn.

When your allowed access to local network, using your local networks gateway and also the networks on the other end of a vpn its called a split tunnel.

http://en.wikipedia.org/wiki/Split_tunneling

Normally users don't want to have to route all traffic through a vpn to access internet, etc.. since normally home internet is faster than routing through the work network, and then using the works internet connection, etc.

Unless your wanting to circumvent something by routing the traffic through the vpn connection, and then some site seeing the vpns IP vs your local one -- I don't really see what your issue is? You stated you have access to the servers using the vpn.

[r0verken]

There is no issue, I was just interested in how it worked and how it knew which hosts are on the vpn, thanks for the info

[+BudMan MVC]

It doesn't really know which hosts on there, it knows what networks are there.

If want to understand how it works, look up routing.

I don't have a mac, but fairly sure since os x is based off darwin that the command would be the same as it is in linux

netstat -nr

this will show you your routing table -- so run it when connected to the vpn and you will see how it knows to send your traffic down the vpn when you want to connect to machine housed at the other end of the vpn.

[dragon2611]

Normally users don't want to have to route all traffic through a vpn to access internet, etc.. since normally home internet is faster than routing through the work network, and then using the works internet connection, etc.

Unless your wanting to circumvent something by routing the traffic through the vpn connection, and then some site seeing the vpns IP vs your local one -- I don't really see what your issue is? You stated you have access to the servers using the vpn.

Some companies would want to block all external network connectivity when on the VPN, and to route all internet traffic via the VPN

1) so that there's no danger of the Local network the remote user is on interacting with the machine when it's on the Corporate network.

2) So that they can log/filter any internet access from the machine whilst it connected to the corporate network.

[r0verken]

2) So that they can log/filter any internet access from the machine whilst it connected to the corporate network.

Why? If the internet isn't going through their vpn server and using the local connection instead then its not their problem, why waste bandwidth by sending it through their server?

[+BudMan MVC]

Quite often you would want to filter the machines internet access if it connects to the work network - to protect it.. Which is why its rare to see split tunnel setups..

You would not want a work computer connecting to the public net unless its going through the company firewall and content filters, does not matter if the computer is at work or some other location.

Quite often you would block all internet access on roaming work machines other then to connect to the vpn -- and then through that connect to the internet through the controlled work connection.

[dragon2611]

Why? If the internet isn't going through their vpn server and using the local connection instead then its not their problem, why waste bandwidth by sending it through their server?

Because you probably don't want machines that are connected to your corporate network which probably has internal data on it users who have access to commercially sensitive information just running around on an unfiltered net connection.

Also by forcing them though the vpn as well as filter you can virus scan traffic at the gateway if you so wish.

Some Companies will also Mandate that the firewall software is installed and running before allowing access to the VPN and will then configure the firewall on the machine to drop all local network traffic so that the machine is only accessable by the VPN and not the network it is connected to.

It usually depends on how strict your IT department are some will let laptop users connect directly to the internet but only when not VPN'd or on their LAN, some will mandate all traffic goes via the VPN/Corp Network and some will probably allow split tunneling.